I know that you know that i know: a deep reinforcement learning and theory of mind approach for intrusion mitigation in low earth orbit satellite networks

Abstract In the cybersecurity domain of Low Earth Orbit (LEO) satellite networks, defenders aim to anticipate attackers’ next intentions and actions based on the current cybersecurity situation, thereby dynamically enhancing defense strategies. To this end, we propose a novel intrusion mitigation framework combining Deep Reinforcement Learning with Theory of Mind (DRL-ToM). By integrating the traffic distribution characteristics mapped from global population density, network link quality, and intrusion detection results, a composite feature space that can capture both service priority and security situation is formed. Furthermore, the bayesian belief update method is introduced to enable defenders to dynamically estimate the probability of a link being attacked based on observations. Curriculum learning mechanism is also utilized to gradually increase the ToM level, thus enabling the step-by-step inference of attackers’ behavior under different cognitive levels in a progressive manner. Finally, the link attack probability and bandwidth, delay and other performance metrics are all incorporated into the path scoring function to realize adaptive traffic allocation and avoidance of high-risk links. Simulation results demonstrate that the DRL-ToM algorithm exhibits optimal comprehensive performance and robustness under attack scenarios. It shows relatively smaller degradation in throughput, increase in latency, and rise in packet loss rate. Particularly, it demonstrates a significant statistical advantage in throughput performance, outperforming the four comparative algorithms by more than 2000 Mbps, 300-500 Mbps, 100-500 Mbps, and 25-85 Mbps respectively. It is concluded that the proposed DRL-ToM can transform the defense strategy from a passive response to an active anticipation, which can significantly enhance the intrusion mitigation and defense capability of LEO satellite networks when facing attacks.